github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 18:54:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(gateway): share device signature reject path

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-15 16:04:37 +00:00
parent cd225c15be
commit 7323953ab0
1 changed files with 17 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
src/gateway/server/ws-connection/message-handler.ts
View File

@@ -561,6 +561,21 @@ export function attachGatewayWsMessageHandler(params: {
nonce: providedNonce || undefined, nonce: providedNonce || undefined,
version: providedNonce ? "v2" : "v1", version: providedNonce ? "v2" : "v1",
}); });
const rejectDeviceSignatureInvalid = () => {
setHandshakeState("failed");
setCloseCause("device-auth-invalid", {
reason: "device-signature",
client: connectParams.client.id,
deviceId: device.id,
});
send({
type: "res",
id: frame.id,
ok: false,
error: errorShape(ErrorCodes.INVALID_REQUEST, "device signature invalid"),
});
close(1008, "device signature invalid");
};
const signatureOk = verifyDeviceSignature(device.publicKey, payload, device.signature); const signatureOk = verifyDeviceSignature(device.publicKey, payload, device.signature);
const allowLegacy = !nonceRequired && !providedNonce; const allowLegacy = !nonceRequired && !providedNonce;
if (!signatureOk && allowLegacy) { if (!signatureOk && allowLegacy) {
@@ -577,35 +592,11 @@ export function attachGatewayWsMessageHandler(params: {
if (verifyDeviceSignature(device.publicKey, legacyPayload, device.signature)) { if (verifyDeviceSignature(device.publicKey, legacyPayload, device.signature)) {
// accepted legacy loopback signature // accepted legacy loopback signature
} else { } else {
setHandshakeState("failed"); rejectDeviceSignatureInvalid();
setCloseCause("device-auth-invalid", {
reason: "device-signature",
client: connectParams.client.id,
deviceId: device.id,
});
send({
type: "res",
id: frame.id,
ok: false,
error: errorShape(ErrorCodes.INVALID_REQUEST, "device signature invalid"),
});
close(1008, "device signature invalid");
return; return;
} }
} else if (!signatureOk) { } else if (!signatureOk) {
setHandshakeState("failed"); rejectDeviceSignatureInvalid();
setCloseCause("device-auth-invalid", {
reason: "device-signature",
client: connectParams.client.id,
deviceId: device.id,
});
send({
type: "res",
id: frame.id,
ok: false,
error: errorShape(ErrorCodes.INVALID_REQUEST, "device signature invalid"),
});
close(1008, "device signature invalid");
return; return;
} }
devicePublicKey = normalizeDevicePublicKeyBase64Url(device.publicKey); devicePublicKey = normalizeDevicePublicKeyBase64Url(device.publicKey);